Privacy Policy
Confidentiality of Personal Data is a top priority for the Administrator in the operation of the KidneyUp Application and the Store. Accordingly, all Medical Data is stored by the Administrator using encryption mechanisms that prevent it from being read by third parties. Reading of the Medical Data is possible only on the device of the Dedicated User and the Guardian having access to the Dedicated User's Medical Data, in accordance with the Regulations. The Administrator, for its own purposes, processes only data and information that do not constitute Personal Data, i.e. data that cannot be linked to a specific individual.
I. DEFINITIONS
- Administrator - a company under the name of KIDNEYUP spółka z ograniczoną odpowiedzialnością with its registered office in Olsztyn, ul. Władysława Trylińskiego nr 14 lok. 13, 10-683 Olsztyn, entered in the Register of Entrepreneurs kept by the District Court in Olsztyn, VIII Economic Department of the National Court Register, KRS: 0000962805, REGON: 521570582, NIP: 739396599, share capital: PLN 5,000.00.
- Application - a mobile device application called KidneyUp made available to the User by the Administrator, the purpose of which is to support the Dedicated User in self-monitoring of the treatment process and monitoring of the course of kidney disease, and - if the Dedicated User uses such functionality - to monitor the Dedicated User's physical and psychological well-being, in particular by monitoring general body parameters such as j temperature, blood pressure, fluid balance or heart rate.
- Medical Data - medical data, constituting Personal Data, concerning a Dedicated User, which was either entered into the Application independently by the Dedicated User or was retrieved by the Application using the Dedicated User's Measuring Device.
- Personal information - any information about a natural person identified or identifiable by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including image, voice recording, contact data, location data, information contained in correspondence, information collected through recording equipment or other similar technology. With respect to the Application, we distinguish Personal Data constituting:
- Medical data;
- Personal Data needed to create an Account and use the Application, not constituting Medical Data.
- Account - a space made available to the User within the Application, where the User's data is collected and where the User gains access to the functionality of the Application.
- Guardian - natural person who is 18 years of age or older, with full legal capacity - who, after reading and accepting the provisions of the Regulations, has completed the registration process in the Application, resulting in the possession of an active account in the Application and:
- to which a Dedicated User, who is not a Dependent, has provided access within the Application to view all or a selection of the Dedicated User's Medical Data, or
- who, being authorized to do so by law, creates a Dedicated User Account for a Dependent and has access to all Medical Data of a Dedicated User who is a Dependent.
- Dependent - a User without legal capacity or with limited legal capacity (including, but not limited to, a person under 18 years of age), on behalf of whom consent to conclude the Agreement referred to in the Regulations and create an Account, including consent to process Personal Data was given by the Guardian referred to in paragraph 6(2) above.
- Data Subject - a natural person to whom Personal Data processed by the Administrator relates, in particular a User and a person who is not a User but, for example, directs an inquiry to the Administrator in the form of an e-mail.
- Policy - this Privacy Policy.
- Regulations - Regulations of the KidneyUp Application.
- RODO - Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
- Store - an online store operated and managed by the Administrator and available at [****].
- Services - services provided in accordance with the Regulations electronically by the Administrator, consisting of providing access to the functionality of the Application, through the ICT system used by the User.
- User:
- natural person over 18 years of age, with full legal capacity - who, after reading and accepting the provisions of the Regulations, has completed the registration process in the Application, resulting in the possession of an active account in the Application;
- A dependent on whose behalf acceptance of the provisions of the Terms and Conditions was made by the Guardian referred to in paragraph 6(2) above, resulting in the possession of an active account in the Application.
- Dedicated User - a User whose Medical Data is recorded and stored in the Application.
- Device - the mobile device on which the Application is installed.
- Measuring Device - a device that allows the Dedicated User's information or results to be directly downloaded and placed in the Application, including but not limited to. wrist-band, smart-watch or glucometer, which can take the form of:
- external device transmitting information directly data to the Application;
- an external device transmitting information to an application dedicated to that device, which then transmits that information to the Application;
- applications other than the Application installed on the Device that transmit information directly to the Application.
II.PROCESSING OF PERSONAL DATA
- In connection with its business activities, including, in particular, through the Application, the Administrator collects and processes Personal Data in accordance with the relevant regulations, including, in particular, the RODO, and the data processing rules provided therein.
- The Administrator:
1. ensures transparency in the processing of Personal Data;
2. informs about the processing of Personal Data at the time of its collection, in particular about the purpose and legal basis for the processing of Personal Data, unless it is not obliged to do so under separate regulations;
3. ensures that Personal Data is collected only to the extent necessary for the indicated purpose and is processed only for the period necessary. - When processing Personal Data, the Administrator shall ensure its security and confidentiality, as well as the access of Data Subjects to information about its processing. Should a breach of the protection of Personal Data (e.g., data "leakage" or loss) occur despite the security measures in place, and such a breach could result in a high risk of infringement of Data Subjects' rights or freedoms, the Administrator shall inform Data Subjects of such an event in a manner consistent with the regulations.
III. GENERAL PRINCIPLES CONCERNING SECURITY OF PERSONAL DATA
- Confidentiality and security of Personal Data are the priority of the Administrator's activities.
- The application collects Personal Data, including Medical Data at the following. Reading of the Medical Data is possible only on the device of the Dedicated User and the Guardian having access to the Dedicated User's Medical Data under the terms of the Regulations. The above means that:
- Neither the Administrator nor any other entity acting for or on behalf of the Administrator shall have access to the Dedicated User's Medical Data;
- the servers used by the Administrator contain only data and information downloaded or entered into the Application, which, however, do not allow to associate them with a particular User (no possibility to identify the User);
- only and exclusively the Dedicated User or the Dependent's Guardian decides to whom and to what extent the Medical Data will be shared.
- The Administrator does not analyze, process or reproduce any Dedicated User's Medical Data that allows for the identification of the Dedicated User.
- The Administrator may use data and information, other than Personal Data needed to create an Account, collected by the Application only if the data is anonymized, i.e., if it is not possible to attribute it to a given Dedicated User, in particular for the purpose of creating anonymous reports and aggregate statistics by the Administrator.
- The Administrator does not share Medical Data with other entities. Only the Dedicated User and the Guardian of the Dependent are the disposers of the Medical Data of a given Dedicated User , and only these entities decide whether to share the Medical Data with other Users or third parties.
- The Dedicated User and the Dependent's Guardian may also download the Medical Data to their own Device and thereby - at their own risk and responsibility - make it available to third parties outside the Application. In such a situation, the Administrator shall not assume any responsibility for such sharing of Medical Data.
- In order to ensure the integrity and confidentiality of Personal Data, the Administrator has implemented procedures that allow access to Personal Data only to authorized persons and only to the extent necessary due to the tasks they perform.
- The Administrator uses organizational and technical solutions to ensure that all operations on Personal Data are recorded and performed only by authorized persons.
- The Administrator shall take the necessary measures to ensure that its subcontractors and other cooperating entities also provide guarantees to apply appropriate security measures whenever they process Personal Data on behalf of the Administrator.
- The Administrator conducts a risk analysis on an ongoing basis and monitors the adequacy of the safeguards applied to Personal Data to the identified risks. If necessary, the Administrator implements additional measures to enhance data security.
IV. PURPOSES AND LEGAL BASIS FOR PROCESSING
- CREATION OF AN ACCOUNT BY THE USER
- In order to be able to create a User Account, it is necessary for the User to provide data for creating the Account, such as, for example, e-mail address, telephone number, or linking the Account to an account held by the User in other applications (e.g. Facebook). By accepting the Terms and Conditions by the User, an agreement for the provision of electronic services is concluded between the User and the Administrator.
- The basis for the processing of Personal Data related to the concluded contract is the necessity to perform the contract or to take action at the User's request prior to its conclusion (Article 6(1)(b) RODO).
- USE OF APPLICATIONS FOR MEDICAL DATA
- In order to be able to use all the functionalities of the Application, in particular with regard to the storage, monitoring and archiving of Medical Data, it is necessary for you to provide Medical Data or for you to agree to associate the Application with the Measuring Device that will transmit this Medical Data to the Application.
- Since Medical Health Data is a special category of Personal Data, the basis for processing Personal Data is express consent (Article 9(2)(a) of the DPA).
- USE OF THE STORE
- In order to be able to use the Store, in particular to conclude a sales contract and a contract for the provision of electronic services for access to the Store, it is necessary to provide Personal Data by the Data Subject necessary to conclude the above contracts.
- With regard to the use of the Store, the basis for the Administrator's processing of Personal Data is the necessity to perform the contract or to take action at the Data Subject's request before the contract is concluded (Article 6(1)(b) of the DPA) and the necessity to fulfill obligations under the law, in particular tax regulations, accounting regulations, consumer rights regulations (Article 6(1)(c) of the DPA).
- ANALYTICAL, STATISTICAL AND RESEARCH PURPOSES
- The Administrator may process the Data Subjects' Personal Data for analytical, statistical and research purposes, in particular by analyzing the Users' activity in the Application and use of the Account, as well as their preferences in order to improve the applied functionalities of the Application.
- Medical data may be processed for analytical, statistical and research purposes with proportionality to these purposes, and with respect to your rights and appropriate measures for their protection.
- The Administrator may process Personal Data in the aforementioned scope for the purpose of preparing reports, analyses, studies and scientific researches at the request of third parties, however such documents will never contain Medical Data allowing to identify the User, but will have the character of collective summaries concerning a given category of predefined characteristics (e.g. a summary of persons suffering from disease X by age or sex).
- The legal basis for the processing is the legitimate interest of the Administrator and necessity for reasons of public interest in the field of public health and necessity for scientific and statistical research (Article 6(1)(f) of the DPA and Article 9(2)(i) and (j) of the DPA).
- E-MAIL AND TRADITIONAL CORRESPONDENCE
- When Data Subjects address the Controller via e-mail or traditional correspondence, the Personal Data contained in such correspondence shall be processed solely for the purpose of communication and resolution of the matter to which the correspondence relates.
- The legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) of the RODO), consisting of correspondence addressed to it in connection with its business activities.
- CALL
- When contacting the Administrator by telephone, on matters not related to the concluded contract or the services provided, the Administrator may request Personal Data only if it is necessary to handle the matter to which the contact relates.
- The legal basis in such a case is the legitimate interest of the Administrator (Article 6(1)(f) of the RODO) consisting of the need to resolve a reported case related to its business activities.
- CLAIMS INVESTIGATION:
- For the purpose of establishing, investigating and enforcing possible claims arising from the way you use the Application or other Administrator services, the Administrator may process certain Personal Data if it is necessary to prove the existence of the Administrator's claim, including the extent of the damage suffered.
- The Controller may process certain Personal Data in order to establish, assert or defend claims related to the Data Subjects' use of the Store, including those related to the handling of the complaint process or the exercise of consumer rights.
- The legal basis in such a case is the legitimate interest of the Administrator (Article 6(1)(f) of the RODO), consisting of the establishment, investigation and enforcement of claims and defense against claims in proceedings before courts and other state authorities.
- IMPLEMENTATION OF USER RIGHTS
- In order to enable you to exercise your rights under the RODO, in particular regarding the possibility of filing complaints, inquiries and requests, the Administrator has the right to process certain Personal Data for this purpose.
- The legal basis in this case is the Administrator's legitimate interest (Article 6(1)(f) of the RODO), which is to enable the User to exercise his/her rights under the RODO.
- SATISFACTION SURVEY ON THE PURCHASE MADE IN THE STORE
- In order for the Administrator to study satisfaction with a purchase made in the Store, the Administrator may send surveys to the e-mail address indicated when placing an order in order to obtain information about the quality of services provided.
- The legal basis in this case is the Administrator's legitimate interest (Article 6(1)(f) RODO) in conducting surveys.
- MARKETING OF SERVICES OFFERED BY THE ADMINISTRATOR:
- Sending commercial information:
- On the basis of consent, which specifies the channel of communication, the Administrator has the right to send messages to the e-mail address and, possibly, to contact by phone, in order to present its services.
- The legal basis is the consent of the Personal Data subject (Article 6(1)(a) of the RODO).
- In the case of consent to send information by e-mail, the legal basis for the processing of personal data will also be Article 10 paragraph 2 of the Act of 18.07.2002 on the provision of electronic services.
- If you agree to be contacted by phone to provide information, the legal basis for processing your personal data will be and Article 172 of the Act of 16.07.2004. Telecommunications Law.
- Newsletter:
- On the basis of the consent given by the Data Subject, the Administrator has the right to send information concerning its activities to the e-mail address provided.
- The legal basis is the consent of the Personal Data subject (Article 6(1)(a) of the RODO).
- Sending commercial information:
V. NECESSITY OF PERSONAL DATA
- Creating an Account
Providing Personal Data is voluntary, but necessary to create an Account within the Application. - Processing of Medical Data in the Application
Provision or sharing of Medical Data is voluntary, but may be necessary to use certain features of the Application. If you do not provide or share Medical Data, you will not be able to use all the functionalities of the Application. - Store
Provision of Personal Data is voluntary, but necessary to make purchases in the Store. - Newsletter
Data subjects will receive a newsletter only if they have provided their e-mail address for this purpose. Providing an e-mail address is voluntary but necessary in order to receive such messages.
VI. BILLING DATA WITHIN THE STORE
- When placing an order in the Store (both through a registered Account and without registering an Account), it is possible to provide billing data, i.e. data of the person or entity (company, foundation or medical entity) to be invoiced for the order made or to be included in the invoice, at the express request of the buyer. The necessary data are indicated in the corresponding forms dedicated to billing data.
- The Personal Data provided by the buyer, as part of the billing data forms, will be processed by the Administrator for the purpose of fulfilling its obligations under the law, in particular tax and accounting regulations. The basis for processing is the necessity to fulfill a legal obligation incumbent on the Administrator (Article 6(1)(c) of the DPA).
- In some cases, institutions such as foundations or medical entities require a PESEL number on the invoice. Therefore, it is optional to do so. From the Administrator's perspective, it is not a mandatory field. The basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) of the DPA), which is to provide the possibility of completing the aforementioned number.
VII. PROFILES ON FACEBOOK AND LINKEDIN
- The Administrator has public profiles on social networks Facebook and LinkedIn. Accordingly, it processes Personal Data left by visitors to these profiles (art. comments, likes, online identifiers).
- Personal data of Data Subjects visiting the Administrator's profiles are processed:
- in order to run profiles effectively, by presenting portal users with information about the Administrator's initiatives and other activities, and in connection with the promotion of various events, services and products;
- For statistical and analytical purposes;
- Alternatively, they may be processed for the purpose of claiming and defending against claims.
- The legal basis for the processing of Personal Data is the legitimate interest of the Administrator (Article 6(1)(f) RODO), consisting of:
- Promoting its own brand and improving the quality of its services,
- If necessary - on the investigation of claims and defense against claims.
- The above information does not apply to the processing of Personal Data by social network administrators (Facebook and LinkedIn). The purpose and scope of processing of Personal Data by the operators of social networks is described in detail in the privacy policies of the aforementioned social networks, available on their websites.
- The Data Subject can always delete his/her comments under the Administrator's posts, stop following the Administrator or resign from having an account on the aforementioned social networks.
VIII. DATA RECIPIENTS
- In connection with the conduct of activities that require the processing of Personal Data, Personal Data , not constituting Medical Data, may be disclosed to external entities, including, in particular, suppliers responsible for the operation of IT systems and equipment, postal operators, couriers, providers of accounting, legal and consulting services, and marketing agencies.
- Medical data, insofar as it identifies a specific User, are neither shared nor transferred by the Administrator to any third parties.
- Personal data of Data Subjects using online payments made available to the payment service provider within the meaning of the Payment Services Act of August 19, 2011.
- The Administrator may share anonymized data (i.e., data that does not identify specific Data Subjects) with third-party service providers in order to better identify the attractiveness of advertisements and services offered by the Administrator.
- The Administrator reserves the right to disclose selected information concerning the User to competent authorities or third parties who make a request for such information, relying on the relevant legal basis and in accordance with the provisions of the applicable law.
IX. TRANSFER OF DATA OUTSIDE THE EEA
The Administrator does not transfer Personal Data outside the European Economic Area.
Medical Data will be stored only on servers located in the European Economic Area.
X. AUTOMATED DECISION-MAKING, INCLUDING PROFILING
- For the proper operation of the Application, the Application must use profiling, which, however, does not result in decisions that produce legal effects towards the User or affect the User in a similarly significant manner. In particular, this applies to the functionality of the Application titled Dedicated User Assistant, which enables the provision of personalized guidance to Dedicated Users.
- When a Data Subject uses the Store, the Controller may use profiling for direct marketing purposes, but the decisions made by the Controller on its basis do not relate to the conclusion or refusal of a contract or the possibility of using electronic services. The effect of using profiling may be, for example, to grant the Data Subject a discount, send a discount code, remind him or her of unfinished purchases, or send a product suggestion that may match his or her interests or preferences.
XI. PERIOD OF PROCESSING OF PERSONAL DATA
- Except in cases that impose a different retention period on the Administrator, the Administrator retains Personal Data, which does not constitute Medical Data, for the period the User has an Account as well as for a period of 3 years after the User deletes or closes the Account.
- The Administrator stores Medical Data only for the period of time the User has an Account.
- The period of processing of Personal Data, which does not constitute Medical Data, may be extended if the processing is necessary for the establishment or assertion of claims or defense against claims, and thereafter only if and to the extent required by law.
- Data related to fiscal, accounting and bookkeeping records resulting from purchases made in the Store (both through a registered Account and without registering an Account), the Administrator stores in accordance with the deadlines set by law, i.e. no longer than 6 years.
- Where Personal Data is processed on the basis of the legitimate interest of the Administrator, the Administrator shall process such data until you successfully object to the processing of Personal Data for the aforementioned purposes.
- Where Personal Data is processed on the basis of consent given by the Data Subject, such consent may be withdrawn at any time. The Personal Data will be processed until the consent is withdrawn. The withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.
XII. RIGHTS OF DATA SUBJECTS
Data subjects have the following rights:
- The right to information about the processing of Personal Data - on this basis, the Administrator provides the individual making the request with information about the processing of Personal Data, including, in particular, the purposes and legal grounds for processing, the scope of the data held, the entities to which they are disclosed, and the planned date of deletion.
- The right to obtain a copy of the data - on this basis the Administrator provides a copy of the processed Personal Data concerning the individual making the request.
- The right to rectification - the Administrator is obliged to remove any inconsistencies or errors in the processed Personal Data and complete them if they are incomplete;
- The right to erasure - on this basis, you can request the erasure of Personal Data, the processing of which is no longer necessary to carry out any of the purposes for which they were collected;
- The right to restrict processing - if such a request is made, the Administrator shall cease performing operations on Personal Data - with the exception of operations consented to by the Data Subject - and storing them, in accordance with accepted retention rules or until the reasons for restricting processing cease to exist (e.g., a decision is issued by a supervisory authority authorizing further processing).
- The right to data portability - on this basis - to the extent that the Personal Data is processed by automated means in connection with a contract concluded or consent given - the Administrator shall issue the data provided by the data subject in a computer-readable format. It is also possible to request that the data be sent to another entity, provided, however, that there are technical capabilities in this regard both on the part of the Administrator and the designated entity;
- Right to object to processing for marketing purposes - the Data Subject may object at any time to the processing of Personal Data for marketing purposes, without having to justify such objection;
- The right to object to other purposes of processing - the Data Subject may object at any time - for reasons related to his/her particular situation - to the processing of Personal Data that is carried out on the basis of a legitimate interest of the Controller (e.g. for analytical or statistical purposes or for reasons related to the protection of property); the objection in this regard should contain a justification.
- The right to withdraw consent - if the data are processed on the basis of the consent given, the Data Subject has the right to withdraw it at any time, which, however, does not affect the lawfulness of the processing performed before the withdrawal;
- The right to complain - if the processing of Personal Data is deemed to violate the provisions of the RODO or other regulations on the protection of Personal Data, the Data Subject may file a complaint with the supervisory authority for the processing of Personal Data, which has jurisdiction over the Data Subject's habitual residence, place of work or place where the alleged violation was committed. In Poland, the supervisory authority is the President of the Office for Personal Data Protection.
XIII. SUBMISSION OF REQUESTS RELATED TO THE EXERCISE OF RIGHTS
- A request for the exercise of Data Subjects' rights can be submitted:
- in writing to the address: KIDNEYUP spółka z ograniczoną odpowiedzialnością with its registered office in Olsztyn at Władysława Trylińskiego No. 14 lok. 13, 10-683 Olsztyn;
- via email to: kontakt@kidneyup.com.
- If the Administrator is unable to identify an individual on the basis of the submitted request, it will ask the applicant for additional information. It is not mandatory to provide such Personal Data, but failure to do so will result in the denial of the request.
- The request may be made in person or through a proxy (e.g., a family member). For reasons of data security, the Administrator encourages the use of a power of attorney in a form certified by a notary public or authorized legal counsel or attorney, which will significantly speed up the verification of the authenticity of the request.
- The application should be responded to within one month of receipt. If it is necessary to extend this period, the Administrator shall inform the applicant of the reasons for this action.
- In the case where the request is addressed to the Administrator electronically, the response shall be provided in the same form, unless the requester has requested a response in another form. In other cases, the response shall be provided in writing. If the timing of the request makes it impossible to respond in writing, and the extent of the applicant's data processed by the Administrator makes it possible to contact him electronically, the response shall be provided electronically.
- The Administrator shall store information regarding the request made and the person who made the request in order to ensure that compliance can be demonstrated and for the purpose of establishing, defending or asserting potential claims by Data Subjects.
XIV. LINKS OF EXTERNAL ENTITIES
- When external links are placed on the Application or the Store, this Policy does not apply to the processing of Personal Data by external parties.
- When posting links, the Administrator shall endeavor, to the extent possible, to determine that they refer only to those entities that process Personal Data in accordance with data protection and security standards. However, the Administrator has no influence over the compliance of other bidders or third parties with data protection and security regulations. Therefore, you should inquire from other bidders or third parties about the data protection regulations they make available.
XV. COOKIES
- Cookies (also known as cookies) are textual information sent by a web server and stored on the user's side (usually on the hard drive). The default parameters of cookies allow only the server that created them to read the information they contain. Cookies are used most often for counters, surveys, online stores, sites that require logins, advertisements and to monitor visitor activity.
- Purposes for storing and accessing cookies:
- Personalization of the website (for example: remembering the selected font size, choosing a version for the visually impaired or a color version);
- Remembering the user's data and choices (for example: not having to enter login and password every time on every subpage, remembering login on re-visit);
- Enabling interaction with social networks (for example: displaying your friends, fans or publishing posts to Facebook and Google+ directly from the site);
- Customization of advertising content displayed on the website;
- Creating website statistics and user flow statistics between different websites;
- The administrator uses technical, analytical and marketing cookies.
- Technical cookies are necessary for the proper operation of the Application. We use them to:
- optimize our website for the devices and browsers that visitors use most often - so your tablet or phone will display it correctly and clearly;
- remember whether you have consented to display selected content on the portal's website.
- We use analytical cookies to improve the functioning of our Application and to measure, without identifying your Personal Information, the effectiveness of our marketing efforts. Among other things, using analytical cookies, we create aggregate statistics and analyses that help us understand how our Application is used. These activities allow us to continuously improve the structure and content of the Application to make it as relevant to the needs of our current and potential customers as possible.
For these types of cookies, we use Google solutions and tools, i.e. Google Analytics and Gemius, i.e. Gemius Traffic. For more information on Google Analytics code and Google's cookies, see Google Analytics Security and Privacy Policy. - Marketing cookies are used to tailor the content and forms of ads, to your needs and preferences. For more information about the cookies used by Google's advertising network, visit the Google AdWords Help page.
- Technical cookies are necessary for the proper operation of the Application. We use them to:
- Below are links to resources showing how you can specify the conditions for storing or accessing cookies using the settings of the most popular web browsers
- Firefox
- Chrome
- Internet Explorer
- Opera
- Safari
- However, please note that if you delete or block cookies, some sections of our websites or Apps may not function properly. If the so-called "opt - out cookie" (which only serves to identify the user's objection - lack of consent) is placed as a result of changing the cookie settings, please note that the opt - out cookie only works in the browser it was saved with. If you delete all cookies, or use another browser or another terminal device, the opt - out setting must be made again.
XVI. PRIVACY POLICY UPDATE
This Privacy Policy may be subject to change resulting either from changes in generally applicable laws or as a result of changes in the scope of services provided by the Administrator. The Administrator will inform you of changes to the Privacy Policy on the websites or on the Application informing you of the date of the changes so that you can exercise your rights under the RODO, in particular revoking your consent or filing an objection.